CVE-2015-8866
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 4.2%
ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote attackers to conduct XML External Entity (XXE) and XML Entity Expansion (XEE) attacks via a crafted XML document, a related issue to CVE-2015-5161.
Produtos afetados
n/a · n/aReferências
http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=de31324c221c1791b26350ba106cc26bad23ace9http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.htmlhttp://rhn.redhat.com/errata/RHSA-2016-2750.htmlhttps://bugs.launchpad.net/ubuntu/+source/php5/+bug/1509817https://bugs.php.net/bug.php?id=64938http://www.openwall.com/lists/oss-security/2016/04/24/1http://www.php.net/ChangeLog-5.phphttp://www.securityfocus.com/bid/87470http://www.ubuntu.com/usn/USN-2952-1http://www.ubuntu.com/usn/USN-2952-2